21K0001 DRAFT SOW.pdf

Managed Security Services/Managed Detection and Response

Statement of Work (SOW)

Version 3.0

October 2020

DRAFT

NSF AIL USAP SIEM MSSP SOW

Table of Contents 1 Service Description

1.1 Functional Definitions

1.2 Standards

1.3 MSSP Implementation Project Management

1.3.1 MSSP Activities in Phase 1 of the USAP SIEM Project

1.3.2 MSSP Activities in Phase 2 of the USAP SIEM Project

1.3.3 MSSP Ongoing Activities in Support of USAP Operations

1.3.4 MSSP Implementation Project Management (Phases 1 and 2)

1.4 MSSP Telecommunications Connectivity Requirements

1.5 Technical Services and Capabilities

1.5.1 Managed Detection and Response (MDR) Services

1.5.2 Incident Response Service (INRS)

1.5.3 MSSP SIEM Log Ingestion:

1.5.4 MSSP SIEM Dashboards and Reporting:

1.6 Responsibility, Accountability, Coordination, and Information Matrix

1.7 Performance Metrics

2 Table of Deliverables

3 Glossary

1 Service Description The National Science Foundation (NSF) Office of Polar Programs (OPP) Antarctic Infrastructure and Logistics Section (AIL) manages the United States Antarctic Program (USAP) which carries forward the Nation's goals of supporting the Antarctic Treaty, fostering cooperative research with other nations, protecting the Antarctic environment, and developing measures to ensure only equitable and wise use of resources. Through the NSF Antarctic Support Contract (ASC), AIL implements the USAP General Support System (USAP GSS) information technology infrastructure to support its operations. The ASC prime contractor is Leidos.

The USAP GSS is a FISMA-Moderate information system with approximately 4000 active devices supporting USAP mission and business activities for the conduct of science research in the Antarctic region. The USAP operating locations include three Antarctic research stations, two deep-ocean research vessels, the global network hub and Enterprise Data Center in Centennial, CO, a Remote Operations Facility in Charleston, SC, and support facilities in Port Hueneme, CA, Alexandria, VA, Christchurch, New Zealand, and Punta Arenas, Chile.

Additional USAP devices may reside in supplier facilities such as White Sands, NM, and the University of Texas Medical Branch (UTMB), Galveston, TX. Each research station and the Christchurch support facility have local area networks with local data centers supporting station users. Logs from station devices are forwarded to the Enterprise Data Center where they are aggregated for analysis. Planning in response to this SOW shall address an ingestion rate of log data that will attain between 300 GB and 400 GB per day when fully implemented.

As the ASC prime contractor, Leidos provides both infrastructure and end-point desk-top and mobile device computing services hosting business software applications, to include Maximo, Pipeline (based on the Permuta Defense Ready product) and the Participant On-Line Antarctic Resource Information Coordination Environment (POLAR ICE), which is an in-house managed web application. Leidos also provides standard Enterprise applications such as office automation software, organizational email, remote network access, and guest network access. Additional AIL partners manage selected devices and capabilities hosted by the USAP GSS. Information about the USAP is available for public access at www.usap.gov. Additional information specific to this SOW will be provided upon request.

The array of services and technologies in the IT arena continues to expand as users and applications are added to the USAP network. At the same time, cybercriminals and corrupt organizations are becoming ever more mobile and sophisticated. Therefore, AIL needs managed security services to safeguard USAP networks and systems against ever-evolving security threats. A Managed Security Services Provider delivers Managed Detection and Response (MDR) services which include Security Incident and Event Management (SIEM) logging and alerting of endpoints, email, web sites, networks, anti-virus, anti-malware/spyware, intrusion detection, and security event management, and capabilities such as authentication.

This is a procurement by the National Science Foundation. AIL is seeking to partner with a Managed Security Services Provider (MSSP) that will use their own internal resources to deliver industry-standard security operations center monitoring capabilities for the USAP, to include providing Managed Detection and Response, Incident Response, and SIEM services. AIL seeks to procure managed security services that will integrate with existing USAP network management activities conducted by Leidos and other USAP partners. The MSSP shall provide and manage their own hardware, software, and telecommunications connectivity to implement the required capabilities for the USAP network, to include their own staff and their own operating locations. No MSSP staff will be located on site at any USAP or other NSF location.

In deploying and operating the monitoring capabilities, the MSSP shall coordinate their activities with AIL and with Leidos and other USAP organizations as designated by AIL.

1.1 Functional Definitions

Final Operating Capability (FOC) is the point in time when the entire MSSP/MDR implementation plan is 100% complete with no outstanding punch list items and all defined tasking is complete. A review is conducted, which is guided by an FOC Checklist. The checklist may be provided by NSF, or by the MSSP with NSF approval. A primary FOC objective is to examine the disposition of all punch-list items remaining after completion of the Initial Operating Capability (IOC) review. FOC is granted by NSF/AIL. Project closeout may only occur after FOC has been granted.

Initial Operating Capability (IOC) is the point in time when the implementation of the MSSP/MDR capability is complete for the intended use by NSF for the USAP. A review of the project implementation plan is conducted with the NSF. This review is guided by an IOC Checklist and includes the following topics:

• Current project completion status

• Review of requirements traceability matrix

• System security review

• Review of any incomplete tasks (i.e., punch-list items)

The checklist may be provided by NSF, or by the MSSP with NSF approval. IOC is granted by

NSF/AIL.

Managed Security Service Provider (MSSP) provides outsourced monitoring and management of security devices and systems. Common services include managed firewall, intrusion detection, virtual private network, vulnerability scanning and anti-viral services. MSSPs use high-availability security operation centers (either from their own facilities or from other data center providers) to provide 24/7 services designed to reduce the number of operational security personnel an enterprise needs to hire, train and retain to maintain an acceptable security posture.

(https://www.gartner.com/en/information-technology/glossary/mssp-managed-security-service-provider)

Managed Detection and Response (MDR) Services deliver 24/7 threat monitoring, detection and lightweight response services to customers leveraging a combination of technologies deployed at the host and network layers, advanced analytics, threat intelligence, and human expertise in incident investigation and response. MDR providers undertake incident validation, and can offer remote response services, such as threat containment, and support in bringing a customer's environment back to some form of "known good."

(https://www.gartner.com/reviews/market/managed-detection-and-response-services/vendors)

Security Information and Event Management (SIEM) technology supports threat detection, compliance and security incident management through the collection and analysis (both near real time and historical) of security events, as well as a wide variety of other event and contextual data sources. The core capabilities are a broad scope of log event collection and management, the ability to analyze log events and other data across disparate sources, and operational capabilities (such as incident management, dashboards, and reporting).

(https://www.gartner.com/en/information-technology/glossary/security-information-and-event-management-siem)

1.2 Standards

Services provided by the MSSP shall comply, at a minimum, with the following standards:

• Federal Information Security Modernization Act of 2014 (FISMA) (44 U.S.C. Section 301)

• NIST FIPS PUB 140-3, Security Requirements for Cryptographic Modules

• NIST FIPS PUB 197, Advanced Encryption Standard (AES)

• NIST FIPS PUB 199, Standards for Security Categorization of Federal Information and

Information Systems

• NIST FIPS PUB 200, Minimum Security Requirements for Federal Information and

Information Systems

• NIST SP 800-37, Rev. 2, Risk Management Framework for Information Systems and

Organizations: A System Life Cycle Approach for Security and Privacy

• NIST SP 800-40, Guide to Enterprise Patch Management Technologies

• NIST SP 800-51, Guide to Using Vulnerability Naming Schemes

• NIST SP 800-53, Rev. 5, Security and Privacy Controls for Information Systems and

Organizations

• NIST SP 800-61, Computer Security Incident Handling Guide

• NIST SP 800-82, Rev. 2, Guide to Industrial Control Systems (ICS) Security

• NIST SP 800-83, Guide to Malware Incident Prevention and Handling for Desktops and

Laptops

• NIST SP 800-92, Guide to Computer Security Log Management

• NIST SP 800-122, Guide to Protecting the Confidentiality of Personally Identifiable

Information (PII)

• NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal

Information Systems and Organizations

• NIST SP 800-171, Rev. 2, Protecting Controlled Unclassified Information in Nonfederal

Systems and Organizations

• United States Computer Emergency Readiness Team (US-CERT) US-CERT Federal

Incident Notification Guidelines (https://us-cert.cisa.gov/incident-notification-guidelines)

• National Science Foundation Information Security Handbook, Manual 7 (provided upon request)

• AIL USAP Information Security policies and procedures (provided upon request)

1.3 MSSP Implementation Project Management

In response to separate tasking from AIL, Leidos has established a project to implement a Security Information and Event Management (SIEM) capability for the USAP in two phases. In Phase 1, Leidos will establish a centralized logging capability for the USAP, while AIL procures MDR and SIEM services from a Managed Security Services Provider. In Phase 2, the MSSP and Leidos will conduct Environmental Tuning of the capability established by the MSSP in Phase 1.

After Phase 2, the MSSP contract transitions to an ongoing operations capability for USAP log monitoring and alerting for the remainder of the contract.

This Statement of Work covers the MSSP activities required in Phase 1 and Phase 2 of the project, MSSP project management actions, and MSSP activities to support ongoing operations.

The SOW includes ingestion and analysis of the logs from the USAP Data Center into the MSSP MDR/SIEM capability and the provision of log monitoring and alerting functions, to include basic and enhanced dashboards and reporting. The activities in this SOW are part of the larger project managed by Leidos. Most MSSP activities occur independently and concurrently with Leidos activities to establish centralized logging; some activities require the MSSP to coordinate with Leidos to establish basic and enhanced log monitoring and alerting reporting capabilities.

1.3.1 MSSP Activities in Phase 1 of the USAP SIEM Project

Phase 1: Establish the Capability to monitor and alert and for basic reporting/dashboards.

Phase 1 concludes when the basic capability is established:

• The MSSP is ingesting USAP logs from any available source

• The MSSP is monitoring the logs and alerting on activities of interest

• The MSSP is providing reports and dashboards

• AIL and Leidos can access the reports and validate their content.

Phase-1 MSSP Activities include all activities to establish the basic capabilities for Managed Detection and Response, Security Information and Event Monitoring, and Incident Response.

In Phase 1 of the USAP SIEM project, the MSSP establishes the telecommunications connectivity to receive USAP log data, to include any hardware or software required to be on premises at the USAP location.

The MSSP coordinates with Leidos to ingest USAP logs from multiple existing sources or from the centralized logging capability, depending on its availability at the time of contract award.

The MSSP establishes basic log monitoring and alerting activities, to include basic dashboards and daily/weekly/monthly reporting, using the ingested log data as the source. DRAFT

Design activities in Phase 1 include the steps required for successful implementation of Phase 1 MSSP logging and alerting (log forwarding/receipt acknowledgement, log caching, default dashboarding and reporting).

At NSF request, the MSSP coordinates with Leidos to establish the centralized logging as the source for the MSSP’s log monitoring and alerting activities once the centralized logging capability is established and available to provide log data.

Phase 1 Outcome: MSSP ingests existing USAP log data and provides basic reporting and dashboards and related services to AIL and Leidos.

• The activities required to forward USAP log data to the MSSP are complete.

• The log data may be forwarded directly from existing USAP logging capabilities, or from the central logging capability once it is established.

• Using their established baseline/default reporting/dashboard processes, the MSSP provides to AIL and Leidos reports and dashboards sourced from USAP log data.

MSSP Phase 1 Activities

1. The contractor shall work with AIL and Leidos staff to define critical assets and data sets to support classification and prioritization of security incidents.

2. The contractor shall work with AIL and Leidos staff to provide USAP environment context to rule out false positives, provide necessary tuning and confirm anomalous behavior.

3. The contractor shall work with AIL and Leidos to establish and maintain a working, well-communicated Configuration/Change Management process so any changes in the MSSP or USAP environment are communicated and coordinated to all parties.

4. The contractor shall provide daily/weekly/monthly reports and quarterly briefings with AIL and Leidos staff.

5. The contractor shall provide best practices for the integration of data sources to ensure maximum visibility and completeness of data sources and data quality for USAP network attached assets. When device data is questionable due to device disconnects or new devices attaching to the network, provide daily, weekly, and monthly reports detailing gaps in data collection or data quality to AIL-designated parties

6. The contractor shall work with AIL and Leidos staff to determine, design, and document any ongoing logical access requirements.

7. The contractor shall work with AIL and Leidos staff to configure USAP data sources (Applications, Endpoints, Networking Devices,) to capture and forward data to the MSSP platform.

8. The contractor shall configure in-scope vendor data sources to supported standards for ingestion, parsing, correlation, and data analysis from various USAP data sources.

9. The contractor shall provide AIL, Leidos, and other AIL-designated parties with client access to the MSSP portal and client information contained within, to include dashboards and reports.

10. The contractor shall document requests/actions with required fields in the MSSP ticketing system, follow documented change processes and implement changes in alignment with AIL USAP policies/procedures/standards.

11. The contractor shall deploy, manage, and repair software agents and packages on user endpoints and servers related to in-scope managed technologies.

12. The contractor shall identify "silent data sources" and other device health performance monitoring related issues.

13. The contractor shall work with AIL and Leidos staff to deploy, rack and stack new and/or replacement systems addressing physical installation and integration.

14. The contractor shall work with AIL and Leidos to submit monthly CyberScope reports to

AIL.

15. The contractor shall work with AIL and Leidos to submit quarterly CIO metrics reports to

AIL.

16. The contractor shall respond to formal requests for information and provide available information based on traffic-light protocol (TLP) handling and sensitivity, per DHS AIS program and/or AIL requests.

17. The contractor shall prioritize Indicators of Compromise (IOC) risk investigations for threat hunting and provide a plan of action for handling potential Advanced Persistent Threat (APT) investigations on a case-by-case to AIL.

18. The MSSP shall configure in-scope vendor data sources service to support standards for ingestion, parsing, correlation, and data analysis from various USAP data sources for monitoring and alerting as noted in Section 1.6.

19. The contractor shall provide client access to the MSSP portal (front-end) with dashboard and reporting capability.

20. The contractor shall work with AIL-designated parties to create daily, weekly, and monthly operational security reports to AIL.

21. The contractor shall ensure that MSSP systems and components comply with applicable NIST SP 800-53 controls for Moderate impact systems (FIPS 199).

1.3.2 MSSP Activities in Phase 2 of the USAP SIEM Project

Phase 2: Environmental Tuning

In Phase 2, the MSSP coordinates with AIL and Leidos to enhance the basic reporting and dashboards established in Phase 1. During Phase 2:

• The MSSP continues to ingest USAP logs, preferably from the USAP centralized logging capability

• The MSSP is monitoring the logs and alerting on activities of interest. Alerting is tuned to the USAP environment.

• The MSSP is providing enhanced reports and dashboards.

• AIL and Leidos can access the reports and validate their content.

Phase-2 MSSP Activities include all activities to establish the enhanced capabilities for Managed Detection and Response, Security Information and Event Monitoring, and Incident Response.

Phase 2 activities are a collaborative effort between the MSSP and Leidos staff. In Phase 2 of the project, the MSSP and Leidos conduct Environmental Tuning of the USAP log monitoring and alerting capability established in Phase 1, to include implementation of enhancements to dashboards and other reporting mechanisms.

The contractor shall work with AIL and Leidos staff to prioritize a list of predefined scenario-based rules to identify the most critical and actionable security events. This is generally referred to as building runbooks or job books that shall be made available to AIL and Leidos upon request.

The MSSP has primary responsibility for the development of the dashboards. Dashboards are tuned to detect malicious patterns that may otherwise go unnoticed using comparisons, signatures, and heuristics. Phase 2 also provides SIEM reporting automation to include security status for the organization for continuous monitoring and enhanced daily/weekly/monthly automated information security management report customization.

The contractor shall integrate automated intelligence to reduce false positives and identify active or potential threats.

Phase 2 Incident Response Tuning includes updates of Incident response alerting and dashboarding development, with alerts and notifications filtered for false positives. This includes customized visualizations with analytics with risk scoring capability for incident response.

Phase 2 also includes Policy Enforcement & NIST Risk Management Framework (RMF) Compliance. Compliance reporting, for example, may provide near-real time data on system threat posture, and compliance against Service Level Agreement (SLA)/Key Performance Indicators (KPI) and metrics.

The contractor shall develop and maintain standard operating procedures (SOP) for their security monitoring and incident response that support USAP’s operating entities. The contractor’s existing procedures may be adapted to meet USAP requirements.

The MSSP will work with Leidos to recommend SIEM modules for security compliance automation, and security compliance reporting automation, following the requirements noted in NIST SP 800-53 and related NIST publications.

These modules implement a continuous monitoring functionality that provides system security maturity.

Phase 2 Outcome: MSSP ingests existing USAP log data and provides enhanced reporting and dashboards and related services to AIL and Leidos.

• The MSSP and Leidos tune the established baseline/default dashboards and reporting to provide an enhanced understanding of USAP logging. DRAFT

1.3.3 MSSP Ongoing Activities in Support of USAP Operations

The MSSP shall establish these Operations Support activities at the start of the contract as part of Phase 1 and maintain them for the life of the contract. These activities occur throughout the life of the contract, starting with the initial ingest of USAP logs for monitoring and alerting at the start of Year-1, and continuing until the completion of the transition plan and project closeout activities at the end of Year-5. Table 2, Contract Activity Summary provides a summary of activities by contract year.

Table 2. Contract Activity Summary

Contract Year

Activity Summary

Year-1 Implementation of MSSP MDR/SIEM capability; ingest USAP logs from available logging sources;

provide basic reporting and dashboards; enhance reporting and dashboards; support USAP incident response. Conduct training as needed for AIL and Leidos staff.

Year-2 Perform operational log monitoring and alerting; work with AIL and Leidos to extend monitoring and alerting to include all USAP endpoints at all locations. Conduct training for AIL and Leidos staff.

Year-3 Perform operational log monitoring and alerting; work with AIL and Leidos to extend monitoring and alerting to include all USAP endpoints at all locations. Conduct training for AIL and Leidos staff.

Year 4 Perform operational log monitoring and alerting; work with AIL and Leidos to extend monitoring and alerting to include all USAP endpoints at all locations. Conduct training for AIL and Leidos staff. Prepare to execute Transition Plan in Year-5.

Year-5 Perform operational log monitoring and alerting; work with AIL and Leidos to extend monitoring and alerting to include all USAP endpoints at all locations. Conduct training for AIL and Leidos staff. Execute Transition Plan; complete contract close-out activities.

The MSSP shall complete the following activities as part of ongoing activities throughout the life of the contract and as requested by AIL.

1. Annually or upon request, the contractor shall provide their most recent SOC Type II audit report with bridge letter to AIL.

2. The contractor shall provide Tier 1 support to continuously monitor security alerts and provide basic triage of correlated security alerts. Provide recommendations on security correlations and alerting, to include recommendations for alerting frequency.

3. The contractor shall provide Tier 2 support to perform deep-dive incident analysis by correlating data from various sources, determine whether critical system or data set has been impacted, advise on remediation, execute containment actions when available and provide support for new analytic methods of detecting threats.

4. The contractor shall provide remediation recommendations for USAP for identified security incidents either through in-scope managed and/or monitored technology platforms or actions to be taken by AIL or Leidos.

5. The contractor shall identify and recommend countermeasures for cyber security threats occurring within the USAP environment through in-scope managed and/or monitored technology platforms.

6. The contractor shall perform incident validation and remote rapid response services, such as threat containment, and support the USAP in mitigating the immediate threat. Perform incident validation of MSSP provided alerts for false positives. Suppressed alerting will be reported monthly to AIL and Leidos.

7. The contractor shall continuously establish and refine operational security standards and procedures based on security incident lessons learned.

8. The contractor shall maintain the latest configuration information for restoration purposes, reporting, and forensics analysis.

9. The contractor shall maintain the managed service capabilities, performing hardware/software upgrades and replacements, and content updates.

10. The contractor shall test and deploy the latest patches and bug fixes as soon as they become available. The contractor shall coordinate all maintenance windows and outages that affect USAP service with AIL and Leidos.

11. The contractor shall perform and document configuration and management as applicable to ensure that security, access, and information-flow policies are enforced for the USAP as requested by AIL.

12. The contractor shall proactively monitor the health and status of MPS hardware/software components on a 24x7x365 basis for indications of compromise such as intrusions, anomalies, malicious activities, and network misuse.

13. The contractor shall monitor the overall performance of the service, including the adequacy of the hardware/software components as the network expands.

14. The contractor shall notify AIL and Leidos of MSSP failure events via email, fax, telephone, dashboards, phone/text alerts or other appropriate means within 30 minutes of event occurrence.

15. The contractor shall provide security training to USAP personnel as required. This includes mock attack drills, emerging threats and vulnerabilities workshops, and new incident response tools and processes demonstrations. The frequency and nature of training activities may vary according to USAP needs.

16. Data backups: The contractor shall include in their proposal and the initial project plan the approach for providing data backups to AIL, especially as it pertains to forensics information. Note how you would provide the data, e.g. what media and in what formats?

17. The contractor shall provide a Transition Plan to identify their approach to execute end-of-contract activities, to include transfer of all USAP data to AIL, or to Leidos, or to another organization designated by AIL.

1.3.4 MSSP Implementation Project Management (Phases 1 and 2) As noted in the USAP SIEM Project Execution Plan, Leidos will provide project management support to NSF for the USAP SIEM project to implement centralized logging and the MSSP MDR/SIEM capability. This includes manage and prepare deliverables; coordinate project reviews; provide project management; provide project cost and schedule controls; manage project risks; manage Leidos subcontractors; and close out the project when completed.

The MSSP shall conduct its own similar project management activities for its responsibilities under this SOW and coordinate with Leidos to integrate its activities within the larger project management support while maintaining its ability to report directly to AIL. The MSSP shall provide an initial Implementation Project Plan for its response to this SOW that includes the scope, schedule, and cost for the services noted in this Statement of Work. The initial plan shall be an attachment to the proposal. The initial plan will be updated in consultation with AIL and Leidos and finalized after contract award.

At a minimum, the initial plan must address the MSSP Project Management activities noted in Table 1, MSSP Implementation Project Activities and Milestones and the activities and milestones for the deliverables noted in Section 2 of this SOW. The contractor is requested to include any additional activities and milestones that their experience indicates need to be tracked as part of the Implementation efforts.

Table 1. MSSP Implementation Project Activities and Milestones

Activity/Summary Timing Implementation Kick-off Meeting with AIL and Leidos post-award, to establish working and coordination relationships and other planning actions within 5 days of contract award

Finalized Implementation plan See Section 2, Table of Deliverables.

within 15 days of contract award to AIL and Leidos

Finalized RACI Matrix See Section 2, Table of Deliverables.

within 15 days of contract award to AIL and Leidos

Finalized Training Plan: Phase 1 and Phase 2 See Section 2, Table of Deliverables.

within 15 days of contract award to AIL and Leidos

Implementation and Operations Weekly Technical Status Report See Section 2, Table of Deliverables.

Weekly by Monday COB to AIL and Leidos. First report due second Monday after contract award.

Implementation and Operations Monthly Management Status Report See Section 2, Table of Deliverables.

Monthly on the first business day of the month. to AIL and Leidos. First report due on first business day of the month after contract award.

MSSP Phase 1 Activities (See Section 1.3.N) Completion of Installation of Telecommunications Capability at USAP location

NLT 60 days after contract award

Completion of Installation of MSSP hardware/software at USAP location

NLT 60 days after contract award

Completion of initial log ingest by MSSP NLT 90 days after contract award Completion of basic reporting and dashboards. AIL and Leidos staff can access all reports and dashboards.

NLT 110 days after contract award

Update USAP Continuous Monitoring status NLT 110 days after contract award Completion of Training planning and execution for the MSSP portion of Phase 1

NLT 110 days after contract award

Completion of Initial Operating Capability (IOC) activities for the MSSP portion of Phase 1.

NLT 120 days after contract award

MSSP Phase 2 Activities (See Section 1.3.N) Completion of Environmental Tuning NLT160 days after contract award Completion of enhancements to basic reporting and dashboards.

NLT160 days after contract award

Monthly automated information security management report customization.

NLT160 days after contract award

Incident response alerting and dashboarding development, with alerts and notifications filtered for false positives.

NLT160 days after contract award

Customized visualizations with analytics with risk scoring capability for incident response.

NLT160 days after contract award

Activity/Summary Timing Training planning and execution for the MSSP portion of Phase 2

NLT160 days after contract award

Completion of the Full Operating Capability (FOC) activities for the MSSP portion of Phase 1 and Phase 2

NLT180 days after contract award

1.4 MSSP Telecommunications Connectivity Requirements

At the start of Phase 1, the MSSP shall establish and maintain the telecommunications services, to include circuits and supporting equipment components, to connect to and interoperate with the USAP networking environment including Demilitarized Zones (DMZs) and secure LANs as required. The service shall also support connectivity to extranets and the Internet through a FIPS 140 & FIPS 197 compliant IPsec or TLS connection for data encryption in transit. The MSSP shall establish the telecommunications capability to provide the secure transport services, including hardware, software, and installation of these items for the purpose of gathering/collecting USAP log data and forwarding that data to the MSSP's system. The ASC Program Office in Centennial, CO will be the USAP connection point.

The address is:

7400 South Tucson Way Centennial, CO, 80112.

The telecommunications capability shall be in place no later than 60 days after contract award.

1.5 Technical Services and Capabilities

In Phase 1 and Phase 2, the MSSP shall provide the following mandatory technical services and capabilities. In the proposal response, identify which services are considered basic to be provided in Phase 1, and enhanced to be provided in Phase 2.

1.5.1 Managed Detection and Response (MDR) Services

1. The contractor shall provide design and implementation services. This will enable AIL, including ASC, and the contractor to discuss matters such as system recommendations, a baseline assessment, rules, signature sets, configurations, and escalation procedures.

2. The contractor shall provide software and hardware components, including log collectors/edge servers, as applicable. Cloud computing services must be authorized by the Federal Risk and Authorization Management Program (FedRAMP).

3. The contractor shall provide software end point agents for HIPS/HIDS, antivirus, antimalware, and other Managed Detection capabilities.

4. The contractor shall implement hardware or software load balancing capabilities and redundancy necessary to meet Key Performance Indicators (KPI) and USAP requirements.

5. The contractor shall provide installation services to include testing of equipment, testing of software, testing of telecommunications capabilities, and loading of any USAP-relevant data, as required by AIL. DRAFT

6. The contractor shall proactively identify USAP network vulnerabilities and misconfigurations and propose appropriate countermeasures, fixes, patches, and workarounds.

7. The contractor shall ensure the service allows only necessary functionality, network protocols, ports, or services with documented AIL approval.

8. The contractor shall perform and document periodic validation activities (e.g., via USAP Nessus scan feeds) to ensure service configurations are not vulnerable and are enforcing AIL USAP policies.

9. The contractor shall be able to receive, handle, and use unclassified cybersecurity indicators provided by the USAP or the Department of Homeland Security (DHS). In some cases, these indicators may require handling as Controlled Unclassified Information

(CUI).

10. The contractor shall ensure that service statistics, events messages, logs, and suspected attack information are sent via secure means to the AIL-specified operation centers.

11. The contractor shall ensure that event messages associated with DHS-provided indicators are sent via secure means to AIL-specified recipients and DHS.

12. The contractor shall ensure that event messages have necessary and consistent timestamps and content to establish context including, as appropriate, date/time of occurrence (including time zone); related indicators, policies, and anomalies; source and destination addresses, ports, and protocols; operating system, processes, and application;

detection source and location.

13. The contractor shall be able to identify and retrieve USAP data for AIL or other USAP entities, without divulging any other agency's or companies’ data.

14. The contractor shall provide AIL and Leidos with secure web access (portal) to logs reports, and service information including the following:

a) Active Sessions

b) Port and Protocol Activity

c) Authentication Statistics

d) Connections/Attempts counts and results (accepted/rejected) by port

e) Events, rule violations, and attacks detected including name, description, level, impact date, time, vulnerabilities and targeted weakness, and remedies

f) Source and Destination IP Addresses, domains (fully qualified domain name) and URLs; as well as statistics

g) Affected endpoints

h) Managed Prevention Service Statistics and Utilization

i) Outages or devices

j) Configuration Modifications

k) Change Requests and Event Tickets

1.5.2 Incident Response Service (INRS)

1. The contractor shall coordinate with AIL and Leidos to support the NSF and the USAP

Incident Response processes.

2. The contractor shall coordinate with AIL and Leidos to handle potential security incidents according to the appropriate response procedures defined by AIL USAP policy. DRAFT

3. The contractor shall review the USAP security infrastructure and develop appropriate incident response plans in collaboration with AIL and Leidos to identify the MSSP role in the USAP Incident Response process.

4. These plans shall detail the MSSP incident response process as it integrates with the USAP process, identify MSSP resources available to support USAP Incident Response, assign duties to MSSP team members, describe policies, define severity levels, list escalation chains, and specify emergency/recovery procedures.

5. The contractor shall provide the USAP with effective incident response support on a 24x7x365 basis. Effective SIEM capabilities include monitoring and alerting on activities that could degrade or otherwise harm USAP operations.

6. The contractor shall maintain a problem detection system to diagnose alerts and violations.

7. The contractor shall analyze suspicious security alerts to determine the significance and scope of an event and immediately notify AIL and Leidos when the event is high priority.

8. The contractor shall provide telephone support to the USAP, as required. Identify options for telephone customer support outside of regular USAP business hours. USAP business hours are within both the Eastern and Mountain time zones.

9. The contractor shall provide AIL and Leidos with immediate access to vulnerability and severe alert information, which shall contain but not be limited to the following:

Description, Target, Origin, Potential Incident Impacts, Remedies, Prevention Measures.

10. The contractor shall provide countermeasures to contain the security incident, limit its spread, and protect internal systems.

11. The contractor shall recommend the fixes necessary to eliminate identified vulnerabilities, and appropriate procedures to guard against future attacks.

12. The contractor shall provide AIL and Leidos with secure web access to incident analysis findings and recommendations.

13. The contractor shall assist AIL and Leidos in containing the damage and restoring affected systems to their normal operational state.

14. The contractor shall assist AIL and Leidos in testing restored systems to ensure that identified vulnerabilities have been corrected.

15. The contractor shall provide dedicated support until resolution of the problem.

16. The contractor shall provide post-incident investigative and forensics services. This includes isolating the impacted area, capturing, and collecting data, categorizing malicious or illegal events, and performing reconstruction analyses.

17. The contractor shall handle and preserve data collected according to sound scientific and evidence rules, as the information may serve as evidence in administrative actions and legal proceedings.

18. The contractor shall trace the offenders and assist in prosecuting attackers, as required.

19. Upon request from AIL, the contractor shall deploy cybersecurity personnel to USAP sites to handle security incidents.

1.5.3 MSSP SIEM Log Ingestion:

The MSSP shall provide the following SIEM capabilities.

1. Firewall: provide SIEM ingestion capability to analyze firewall log data to include protocol type, source address, destination address, source port, and/or destination port, as provided in USAP firewall logs. SIEM Firewall ingestion must also include Network

Address Translation (NAT) and Port Address Translation (PAT) firewall log ingestion capability.

2. Network Intrusion Prevention System: provide SIEM ingestion capability to analyze in-line Intrusion Prevention System logs to include network and application protocol activity and content to log and alert on suspicious activity, for the purpose of blocking or disrupting activity based on signatures and behavior.

3. Endpoint Protection: provide SIEM ingestion of host-based intrusion prevention with logging, and alerting capability that may including endpoint firewalls, endpoint recording, and threat detection, whitelisting, banning, and remediation to protect USAP endpoints.

4. Secure Web Proxy: provide SIEM ingestion capability to analyze secure web proxy content filtering with logging, and alerting capability.

5. Inbound Web Proxy: provide SIEM ingestion capability for inbound web sessions to reverse proxy (including Squid and Apache) with logging, and alerting capability.

6. Application-Level Gateway: provide SIEM ingestion capability for application level gateways with logging, and alerting capability. an intermediary between endpoints allowing for application layer control/data protocols (FTP, SIP, IM, etc.) to be proxied.

7. Network Behavior Analysis: provide a capability that develops a profile of 'normal' USAP behavior and examines network traffic (including encrypted sessions and/or deep-packet inspection) to identify threats that generate unusual traffic flows, such as Distributed Denial of Service (DdoS) attacks, scanning, and certain forms of malware.

perform anomaly detection to identify atypical traffic trends and unusual behaviors that may indicate a potential attack. Maintain logs of at least the source, destination, and size of the encrypted connections for further analysis.

8. Network Flow: provide a capability for the ingestion of NetFlow and/or IPFIX logging.

9. Email phishing, Anti-spam, Protection and Filtering: provide ingestion capability for application Email phishing, Anti-spam, Protection and Filtering (to include Xwall, and Windows Exchange Server 2016) with logging, and alerting capability.

10. Email Content Analysis and Sandboxing: provide ingestion capability for email traffic and content analysis and sandboxing.

11. User Authentication Integration: support the integration of USAP authentication services (including Microsoft Active Directory with Kerberos integration, and HSPD-12). Log authentications and alert on authentication failures (multiple retries, etc.).

12. Data Loss Prevention: provide search capability to discover and identify sensitive data and alert on its presence (e.g. social security numbers).

13. IPsec or TLS VPN: support an IPsec or TLS VPN (Virtual Private Network) to provide data encryption in transit for the ingest of USAP data in accordance with all federal regulations, policies and standards (including FIPS compliant key length and strength, NIST compliant Key rotation, and key agreement protocols, etc.).

14. Storage: provide a minimum of 90 days of active, and immediately searchable log data.

Provide access to one year near online searchable data in archived storage. Archived data shall be made securely available to AIL-designated parties within 72 hours upon request.

1.5.4 MSSP SIEM Dashboards and Reporting:

1. Advanced Analytics: provide and apply various statistical techniques from the modeling, machine learning, data analysis relevant for threat discovery, assessment, situational awareness, prediction capabilities, signatures and correlations, as applicable, to establish the statistical significance and reporting of SIEM findings.

2. Provide AIL-designated parties with the following dashboard (portal accessible) elements:

a. Active Sessions.

b. Port and Protocol Activity.

c. Authentication Statistics.

d. Events, rule violations, and attacks detected including name, description, level, impact date, time, vulnerabilities, and target.

e. Source and Destination IP Addresses, domains (fully-qualified domain name) and

URLs as applicable.

f. Affected endpoints.

g. Security Posture and/or Managed Prevention Service Statistics and Utilization.

h. Threat Activity.

3. Provide recommendations, and periodic reporting capability for the elements listed above and the capability and facility for additional customized reporting.

4. Remote Client VPNs: provide secure remote access for authorized AIL-designated users to a SIEM front-end, employing VPN encryption technology in accordance with all federal regulations provided in the standards section (e.g. FIPS compliant key length and strength, NIST compliant Key rotation, and key agreement protocols, etc.), such as the latest version of TLS (Transport Layer Security).

1.6 Responsibility, Accountability, Coordination, and Information Matrix The contractor shall provide an initial Responsibility, Accountability, Coordination, and Information (RACI) Matrix for services provided under this SOW. The MSSP shall include their proposed of the RACI Matrix as an attachment to their proposal, to include any activities not listed in the SOW. The final version of the RACI Matrix shall be published as part of the finalized Implementation Project Plan and shall include input from AIL and Leidos.

Table 3. Responsibility, Accountability, Coordination, and Information (RACI) Matrix

Item# Activity MSSP ASC NSF MSSP enter activities here from Section 1 above.

1.7 Performance Metrics

The MSSP provider shall provide the following Service Performance Metrics:

Table 4. MSSP Service Performance Metrics

Key Performance Indicator (KPI)

Service Level

Performance Standard (Threshold)

Acceptable Quality Limit How Measured

Availability / Uptime Routine 99.5% ≥ 99.5% See Note 1 MSSP Outage Event Notification

Routine Within 10 minutes < 10 minutes

Event Notification Routine Next business day or within 24 hours for a Low category event

≤ Next business day or 24 hours

See Note 2

Within 4 hours of a Medium category event

≤ 4 hours

Within 1 hour of a High category event

< 1 hour

Grade of Service

(MSSP)

Routine Within 24 hours (NIST CVSS v3.0 Rating at High or Critical) and 30 days < (for CVSS v3.0 Rating at medium or below).

≤ 24 hours (NIST CVSS v3.0 Rating at High or Critical) and 30 days < (for CVSS v3.0 Rating at medium or below)

See Note 3

Incident Response Time (Automated Alerting)

Routine Within 1 hour of the notification for a Low category incident

≤ 1 hour See Note 4

Within 15 minutes of the notification for a High category incident

≤ 15 minutes

Notes:

1. MSS availability is calculated as a percentage of the total reporting interval time that the MSS is operationally available to the USAP. Availability is computed by the standard formula:

RI = Time Period (24 hours, number of days expressed in hours) COT = number of hours of downtime/service interruption.

2. The Event Notification value represents the elapsed time between the detection of the event and the notification of AIL-designated parties. Events are categorized as follows:

a) Low — Events in the Low category have a negligible impact on service. They include firewall incidents that do not significantly affect network security, as well as minor hardware, software, and configuration problems.

b) Medium — Events in the Medium category have a more serious impact on service, and may indicate a possible security breach, threat, or attack attempt. They may also cause the service to operate in a degraded state.

c) High — Events in the High category represent events that severely impact service and operations. They indicate a true compromise of network security. These events also include major hardware, software, and configuration problems, and are immediately reported via automated alerts flagged/indicated as high categorization for immediate review, as specified by AIL.

3. The Grade of Service (MSSP) value represents the elapsed time between NIST NVD alert publication and MSP patch completion.

4. The Incident Response Time (Automated Alerting) value represents the elapsed time between a MSSP event and automated alerting/notification by email and/or dashboard to AIL (depending upon USAP configuration).

HRRI

HRCOTHRRItyAvailabili

2 Table of Deliverables The MSSP shall deliver the following items to AIL and AIL-designated recipients. Other deliverables may be identified by AIL as USAP mission needs dictate.

Table 5. MSSP Deliverables

Deliverable Due Date/Time Finalized MSSP Implementation Project Plan Updated and final version of the MSSP Implementation Project Plan based on input received from AIL and Leidos during the Implementation Kick-off.

within 15 days of contract award

Finalized RACI Matrix Updated and final version of the RACI Matrix based on input received from AIL and Leidos during the Implementation Kick-off. (included in project plan) within 15 days of contract award

Finalized Training Plan: Phase 1 and Phase 2 Updated and finalized plan for training to be provided by the MSSP to AIL and Leidos staff. Includes training needed to use the capability at the end of Phase 1 and at the end of Phase 2. (included in project plan) within 15 days of contract award

Daily technical monitoring reports covering the previous 24-72 hour period to account for weekends and holidays.

Each business day by 0700 Eastern time

Implementation and Operations Weekly Technical Status Report Technical status report. Begins in Phase 1 implementation and continues through Phase 2 and Operations Support for duration of contract. Written report with the following content:

Weekly technical monitoring report covering the previous 7-day period.

Work Management Section that describes work completed in prior week; work in progress with planned completion date; work planned for current week; work forecast for next two weeks; delays and potential delays and plans to resolve delays.

Weekly by Monday COB to AIL and Leidos. First report due second Monday after contract award.

Implementation and Operations Monthly Management Status Report Management status report. Begins in Phase 1 implementation and continues through Phase 2 and Operations Support for duration of contract. Written report with the following content:

Monthly technical monitoring reports covering entire previous month Status on Schedule plan and updates (ASC and Leidos) Status on Cost plan and updates (AIL only).

Status on Training completed and training planned Includes forecast of activities for next 30/60/90 days of contract.

Monthly on the first business day of the month for the entire period since the previous report. Provided to AIL and Leidos. First report due on first business day of the month after contract award.

Quarterly technical implementation and operations status reports, to include technical monitoring reports covering the entire quarter

First business day of the quarter for the entire period since the previous report.

Forensics technical Reporting As needed Potential Breach investigations and follow-up reporting Each occurrence Ad hoc technical and management reports as requested by AIL As agreed-to with the MSSP

3 Glossary

AIL Antarctic Infrastructure and Logistics Section ASC Antarctic Support Contract DDoS Distributed Denial of Service FISMA Federal Information Security Modernization Act FIPS Federal Information Processing Standards FTP File Transfer Protocol HSPD Homeland Security Presidential Directive ICSM Information Security Continuous…